Using a transaction is the recommended approach for this scenario... Or you can configure your security rules to make sure the write fails if the document already exists (though it'll be a permission_denied error in this case).

With #2436, you will no longer have to perform a dummy update if your document exists, since we no longer require that every document read must be written to. Adding transaction.create() is still something that's on our radar, but it's relatively low-priority because this functionality can be achieved using the existing API.